1// Copyright 2012 Google Inc. All Rights Reserved.
2//
3// Use of this source code is governed by a BSD-style license
4// that can be found in the COPYING file in the root of the source
5// tree. An additional intellectual property rights grant can be found
6// in the file PATENTS. All contributing project authors may
7// be found in the AUTHORS file in the root of the source tree.
8// -----------------------------------------------------------------------------
9//
10// PNG decode.
11
12#include "./pngdec.h"
13
14#ifdef HAVE_CONFIG_H
15#include "webp/config.h"
16#endif
17
18#include <stdio.h>
19
20#ifdef WEBP_HAVE_PNG
21#ifndef PNG_USER_MEM_SUPPORTED
22#define PNG_USER_MEM_SUPPORTED  // for png_create_read_struct_2
23#endif
24#include <png.h>
25#include <setjmp.h>   // note: this must be included *after* png.h
26#include <stdlib.h>
27#include <string.h>
28
29#include "webp/encode.h"
30#include "./imageio_util.h"
31#include "./metadata.h"
32
33#define LOCAL_PNG_VERSION ((PNG_LIBPNG_VER_MAJOR << 8) | PNG_LIBPNG_VER_MINOR)
34#define LOCAL_PNG_PREREQ(maj, min) \
35   (LOCAL_PNG_VERSION >= (((maj) << 8) | (min)))
36
37static void PNGAPI error_function(png_structp png, png_const_charp error) {
38  if (error != NULL) fprintf(stderr, "libpng error: %s\n", error);
39  longjmp(png_jmpbuf(png), 1);
40}
41
42#if LOCAL_PNG_PREREQ(1,4)
43typedef png_alloc_size_t LocalPngAllocSize;
44#else
45typedef png_size_t LocalPngAllocSize;
46#endif
47
48static png_voidp MallocFunc(png_structp png_ptr, LocalPngAllocSize size) {
49  (void)png_ptr;
50  if (size != (size_t)size) return NULL;
51  if (!ImgIoUtilCheckSizeArgumentsOverflow(size, 1)) return NULL;
52  return (png_voidp)malloc((size_t)size);
53}
54
55static void FreeFunc(png_structp png_ptr, png_voidp ptr) {
56  (void)png_ptr;
57  free(ptr);
58}
59
60// Converts the NULL terminated 'hexstring' which contains 2-byte character
61// representations of hex values to raw data.
62// 'hexstring' may contain values consisting of [A-F][a-f][0-9] in pairs,
63// e.g., 7af2..., separated by any number of newlines.
64// 'expected_length' is the anticipated processed size.
65// On success the raw buffer is returned with its length equivalent to
66// 'expected_length'. NULL is returned if the processed length is less than
67// 'expected_length' or any character aside from those above is encountered.
68// The returned buffer must be freed by the caller.
69static uint8_t* HexStringToBytes(const char* hexstring,
70                                 size_t expected_length) {
71  const char* src = hexstring;
72  size_t actual_length = 0;
73  uint8_t* const raw_data = (uint8_t*)malloc(expected_length);
74  uint8_t* dst;
75
76  if (raw_data == NULL) return NULL;
77
78  for (dst = raw_data; actual_length < expected_length && *src != '\0'; ++src) {
79    char* end;
80    char val[3];
81    if (*src == '\n') continue;
82    val[0] = *src++;
83    val[1] = *src;
84    val[2] = '\0';
85    *dst++ = (uint8_t)strtol(val, &end, 16);
86    if (end != val + 2) break;
87    ++actual_length;
88  }
89
90  if (actual_length != expected_length) {
91    free(raw_data);
92    return NULL;
93  }
94  return raw_data;
95}
96
97static int ProcessRawProfile(const char* profile, size_t profile_len,
98                             MetadataPayload* const payload) {
99  const char* src = profile;
100  char* end;
101  int expected_length;
102
103  if (profile == NULL || profile_len == 0) return 0;
104
105  // ImageMagick formats 'raw profiles' as
106  // '\n<name>\n<length>(%8lu)\n<hex payload>\n'.
107  if (*src != '\n') {
108    fprintf(stderr, "Malformed raw profile, expected '\\n' got '\\x%.2X'\n",
109            *src);
110    return 0;
111  }
112  ++src;
113  // skip the profile name and extract the length.
114  while (*src != '\0' && *src++ != '\n') {}
115  expected_length = (int)strtol(src, &end, 10);
116  if (*end != '\n') {
117    fprintf(stderr, "Malformed raw profile, expected '\\n' got '\\x%.2X'\n",
118            *end);
119    return 0;
120  }
121  ++end;
122
123  // 'end' now points to the profile payload.
124  payload->bytes = HexStringToBytes(end, expected_length);
125  if (payload->bytes == NULL) return 0;
126  payload->size = expected_length;
127  return 1;
128}
129
130static const struct {
131  const char* name;
132  int (*process)(const char* profile, size_t profile_len,
133                 MetadataPayload* const payload);
134  size_t storage_offset;
135} kPNGMetadataMap[] = {
136  // http://www.sno.phy.queensu.ca/~phil/exiftool/TagNames/PNG.html#TextualData
137  // See also: ExifTool on CPAN.
138  { "Raw profile type exif", ProcessRawProfile, METADATA_OFFSET(exif) },
139  { "Raw profile type xmp",  ProcessRawProfile, METADATA_OFFSET(xmp) },
140  // Exiftool puts exif data in APP1 chunk, too.
141  { "Raw profile type APP1", ProcessRawProfile, METADATA_OFFSET(exif) },
142  // XMP Specification Part 3, Section 3 #PNG
143  { "XML:com.adobe.xmp",     MetadataCopy,      METADATA_OFFSET(xmp) },
144  { NULL, NULL, 0 },
145};
146
147// Looks for metadata at both the beginning and end of the PNG file, giving
148// preference to the head.
149// Returns true on success. The caller must use MetadataFree() on 'metadata' in
150// all cases.
151static int ExtractMetadataFromPNG(png_structp png,
152                                  png_infop const head_info,
153                                  png_infop const end_info,
154                                  Metadata* const metadata) {
155  int p;
156
157  for (p = 0; p < 2; ++p)  {
158    png_infop const info = (p == 0) ? head_info : end_info;
159    png_textp text = NULL;
160    const png_uint_32 num = png_get_text(png, info, &text, NULL);
161    png_uint_32 i;
162    // Look for EXIF / XMP metadata.
163    for (i = 0; i < num; ++i, ++text) {
164      int j;
165      for (j = 0; kPNGMetadataMap[j].name != NULL; ++j) {
166        if (!strcmp(text->key, kPNGMetadataMap[j].name)) {
167          MetadataPayload* const payload =
168              (MetadataPayload*)((uint8_t*)metadata +
169                                 kPNGMetadataMap[j].storage_offset);
170          png_size_t text_length;
171          switch (text->compression) {
172#ifdef PNG_iTXt_SUPPORTED
173            case PNG_ITXT_COMPRESSION_NONE:
174            case PNG_ITXT_COMPRESSION_zTXt:
175              text_length = text->itxt_length;
176              break;
177#endif
178            case PNG_TEXT_COMPRESSION_NONE:
179            case PNG_TEXT_COMPRESSION_zTXt:
180            default:
181              text_length = text->text_length;
182              break;
183          }
184          if (payload->bytes != NULL) {
185            fprintf(stderr, "Ignoring additional '%s'\n", text->key);
186          } else if (!kPNGMetadataMap[j].process(text->text, text_length,
187                                                 payload)) {
188            fprintf(stderr, "Failed to process: '%s'\n", text->key);
189            return 0;
190          }
191          break;
192        }
193      }
194    }
195    // Look for an ICC profile.
196    {
197      png_charp name;
198      int comp_type;
199#if LOCAL_PNG_PREREQ(1,5)
200      png_bytep profile;
201#else
202      png_charp profile;
203#endif
204      png_uint_32 len;
205
206      if (png_get_iCCP(png, info,
207                       &name, &comp_type, &profile, &len) == PNG_INFO_iCCP) {
208        if (!MetadataCopy((const char*)profile, len, &metadata->iccp)) return 0;
209      }
210    }
211  }
212  return 1;
213}
214
215typedef struct {
216  const uint8_t* data;
217  size_t data_size;
218  png_size_t offset;
219} PNGReadContext;
220
221static void ReadFunc(png_structp png_ptr, png_bytep data, png_size_t length) {
222  PNGReadContext* const ctx = (PNGReadContext*)png_get_io_ptr(png_ptr);
223  if (ctx->data_size - ctx->offset < length) {
224    png_error(png_ptr, "ReadFunc: invalid read length (overflow)!");
225  }
226  memcpy(data, ctx->data + ctx->offset, length);
227  ctx->offset += length;
228}
229
230int ReadPNG(const uint8_t* const data, size_t data_size,
231            struct WebPPicture* const pic,
232            int keep_alpha, struct Metadata* const metadata) {
233  volatile png_structp png = NULL;
234  volatile png_infop info = NULL;
235  volatile png_infop end_info = NULL;
236  PNGReadContext context = { NULL, 0, 0 };
237  int color_type, bit_depth, interlaced;
238  int has_alpha;
239  int num_passes;
240  int p;
241  volatile int ok = 0;
242  png_uint_32 width, height, y;
243  int64_t stride;
244  uint8_t* volatile rgb = NULL;
245
246  if (data == NULL || data_size == 0 || pic == NULL) return 0;
247
248  context.data = data;
249  context.data_size = data_size;
250
251  png = png_create_read_struct_2(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL,
252                                 NULL, MallocFunc, FreeFunc);
253  if (png == NULL) goto End;
254
255  png_set_error_fn(png, 0, error_function, NULL);
256  if (setjmp(png_jmpbuf(png))) {
257 Error:
258    MetadataFree(metadata);
259    goto End;
260  }
261
262#if LOCAL_PNG_PREREQ(1,5) || \
263    (LOCAL_PNG_PREREQ(1,4) && PNG_LIBPNG_VER_RELEASE >= 1)
264  // If it looks like the bitstream is going to need more memory than libpng's
265  // internal limit (default: 8M), try to (reasonably) raise it.
266  if (data_size > png_get_chunk_malloc_max(png) && data_size < (1u << 24)) {
267    png_set_chunk_malloc_max(png, data_size);
268  }
269#endif
270
271  info = png_create_info_struct(png);
272  if (info == NULL) goto Error;
273  end_info = png_create_info_struct(png);
274  if (end_info == NULL) goto Error;
275
276  png_set_read_fn(png, &context, ReadFunc);
277  png_read_info(png, info);
278  if (!png_get_IHDR(png, info,
279                    &width, &height, &bit_depth, &color_type, &interlaced,
280                    NULL, NULL)) goto Error;
281
282  png_set_strip_16(png);
283  png_set_packing(png);
284  if (color_type == PNG_COLOR_TYPE_PALETTE) {
285    png_set_palette_to_rgb(png);
286  }
287  if (color_type == PNG_COLOR_TYPE_GRAY ||
288      color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
289    if (bit_depth < 8) {
290      png_set_expand_gray_1_2_4_to_8(png);
291    }
292    png_set_gray_to_rgb(png);
293  }
294  if (png_get_valid(png, info, PNG_INFO_tRNS)) {
295    png_set_tRNS_to_alpha(png);
296    has_alpha = 1;
297  } else {
298    has_alpha = !!(color_type & PNG_COLOR_MASK_ALPHA);
299  }
300
301  // Apply gamma correction if needed.
302  {
303    double image_gamma = 1 / 2.2, screen_gamma = 2.2;
304    int srgb_intent;
305    if (png_get_sRGB(png, info, &srgb_intent) ||
306        png_get_gAMA(png, info, &image_gamma)) {
307      png_set_gamma(png, screen_gamma, image_gamma);
308    }
309  }
310
311  if (!keep_alpha) {
312    png_set_strip_alpha(png);
313    has_alpha = 0;
314  }
315
316  num_passes = png_set_interlace_handling(png);
317  png_read_update_info(png, info);
318
319  stride = (int64_t)(has_alpha ? 4 : 3) * width * sizeof(*rgb);
320  if (stride != (int)stride ||
321      !ImgIoUtilCheckSizeArgumentsOverflow(stride, height)) {
322    goto Error;
323  }
324
325  rgb = (uint8_t*)malloc((size_t)stride * height);
326  if (rgb == NULL) goto Error;
327  for (p = 0; p < num_passes; ++p) {
328    png_bytep row = rgb;
329    for (y = 0; y < height; ++y) {
330      png_read_rows(png, &row, NULL, 1);
331      row += stride;
332    }
333  }
334  png_read_end(png, end_info);
335
336  if (metadata != NULL &&
337      !ExtractMetadataFromPNG(png, info, end_info, metadata)) {
338    fprintf(stderr, "Error extracting PNG metadata!\n");
339    goto Error;
340  }
341
342  pic->width = (int)width;
343  pic->height = (int)height;
344  ok = has_alpha ? WebPPictureImportRGBA(pic, rgb, (int)stride)
345                 : WebPPictureImportRGB(pic, rgb, (int)stride);
346
347  if (!ok) {
348    goto Error;
349  }
350
351 End:
352  if (png != NULL) {
353    png_destroy_read_struct((png_structpp)&png,
354                            (png_infopp)&info, (png_infopp)&end_info);
355  }
356  free(rgb);
357  return ok;
358}
359#else  // !WEBP_HAVE_PNG
360int ReadPNG(const uint8_t* const data, size_t data_size,
361            struct WebPPicture* const pic,
362            int keep_alpha, struct Metadata* const metadata) {
363  (void)data;
364  (void)data_size;
365  (void)pic;
366  (void)keep_alpha;
367  (void)metadata;
368  fprintf(stderr, "PNG support not compiled. Please install the libpng "
369          "development package before building.\n");
370  return 0;
371}
372#endif  // WEBP_HAVE_PNG
373
374// -----------------------------------------------------------------------------
375